CVE-2021-24431

MEDIUM

Language Bar Flags < 1.0.8 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/ae50cec9-5f80-4221-b6a8-4593ab66c37b

Scores

CVSS v3 4.3
EPSS 0.0047
EPSS Percentile 37.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-352 CWE-79
Status published
Products (1)
language_bar_flags_project/language_bar_flags < 1.0.8
Published Sep 13, 2021
Tracked Since Feb 18, 2026